What is CMMC compliance?
Published 2026-10-23, 13 min read
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Contracts may require CMMC Level 1 (Self) or Level 2 (Self): your own assessment, scored and entered in SPRS, with a senior official's affirmation. Class Deviation 2026-O0025 Rev 3; 32 CFR 170.15, 170.16
- The CMMC rule itself, 32 CFR Part 170, is unchanged since it took effect on 2024-12-16. eCFR, 32 CFR Part 170
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Existing contracts that carry CMMC requirements have them removed at the next option period or the next scheduled administrative modification. Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
- DoD's 2026 Regulatory Plan lists an interim final rule amending 32 CFR Part 170 (RIN 0790-AM01) to set a deadline and transition from NIST SP 800-171 Rev 2 to Rev 3. It was timetabled for July 2026 and has not been published as of 2026-10-23. 91 FR 52824
- Class Deviation 2026-O0025, Revision 3 (DFARS part 240), read 2026-10-23
- DFARS 252.204-7012, -7019, -7020, -7021 (acquisition.gov), read 2026-10-23
- 32 CFR Part 170 (eCFR), read 2026-10-23
- Federal Register 2026-16603, 2026 Regulatory Plan (RIN 0790-AM01), read 2026-10-23
- Federal Register: CMMC documents, read 2026-10-23
CMMC compliance in plain words
CMMC, the Cybersecurity Maturity Model Certification, is the Department of Defense's program for checking that the companies it buys from protect two kinds of information on their own computers: federal contract information (FCI) and controlled unclassified information (CUI). The rules are in 32 CFR Part 170. A contract switches them on with DFARS clause 252.204-7021, where the contracting officer writes in the level you must hold.
Being CMMC compliant is not a certificate on the wall. It is four things that stay true for as long as the contract runs, on every system that holds the contract's FCI or CUI:
Meet the level's requirements
Level 1 is the 15 basic safeguarding requirements of FAR 52.204-21(b)(1)(i)–(xv). Level 2 is the 110 security requirements of NIST SP 800-171 Rev 2.
32 CFR 170.14(c)
Get them assessed
By yourself, by an accredited third-party assessor (a C3PAO) or by the government's own assessors, whichever the contract names.
32 CFR 170.15–170.18
Enter the result in SPRS
The level, the status date, the assessment scope, every CAGE code it covers and the result go into the Supplier Performance Risk System.
32 CFR 170.15(a)(1)(i), 170.16(a)(1)(i)
Affirm, and keep it current
A senior official affirms after every assessment and every year after that. A lapsed affirmation means a status that is no longer current.
32 CFR 170.22(a); DFARS 252.204-7021(d)(3)
The surprise for most shops is how little of this is new. At Level 2, CMMC adds no requirement of its own: it checks the same NIST list the DFARS has asked for since 2017. The two are set side by side in CMMC vs NIST SP 800-171, and the list itself is explained in what NIST SP 800-171 is.
If a contract already carries DFARS 252.204-7012, you have owed NIST SP 800-171 since that clause's deadline, "not later than December 31, 2017". CMMC changes who checks the work and where the result is recorded, not the work itself.
The three levels on one sheet
CMMC has three levels, and Level 2 comes in two kinds: assessed by you or by a third party. The contract clause lists exactly those four, so they are the four columns below. Read down a column to see everything one status asks of you.
| What the rule sets | Level 1 (Self) | Level 2 (Self) | Level 2 (C3PAO) | Level 3 (DIBCAC) |
|---|---|---|---|---|
| Information it protects§ 170.3(d), 170.23(a) | FCI | CUI | CUI | CUI |
| Requirements§ 170.14(c) | 15, from FAR 52.204-21 | 110, from NIST SP 800-171 Rev 2 | The same 110 | The 110, plus 24 from NIST SP 800-172 |
| Who assesses§ 170.15–170.18 | You | You | An accredited C3PAO | DCMA's DIBCAC |
| Result§ 170.15(a), 170.18(a), 170.24 | MET or NOT MET, all 15 | A score out of 110 | A score out of 110 | A score out of 24, 1 point each |
| Repeated§ 170.15–170.18 | Every year | Every 3 years | Every 3 years | Every 3 years |
| POA&M allowed§ 170.21 | No | Limited: 88 of 110, 180 days | Limited: 88 of 110, 180 days | Limited, with its own exclusions |
| Affirmation§ 170.22(a) | Every year | Every year | Every year | Every year |
| In contracts todayStatus box above | May be required | May be required | Suspended | Suspended |
The statuses stack. A Level 2 (Self) status also satisfies Level 1 (Self) for the same systems, a Level 2 (C3PAO) status satisfies both self-assessed ones, and Level 3 builds on a Final Level 2 (C3PAO). So a shop never needs two assessments of the same systems at different levels. Level 1 line by line is in CMMC Level 1 requirements, Level 2 in CMMC Level 2 requirements, and each has a working checklist: the Level 1 self-assessment checklist and the NIST SP 800-171 checklist.
Who needs CMMC, and which level
Part 170 reaches every DoD contractor and subcontractor that will process, store or transmit FCI or CUI on its own information systems while performing the contract. Size does not enter into it: a five-person machine shop holding a customer's drawing is covered the same way as its prime. The exceptions are narrow, and they are all about the purchase, not the company.
- Covered
- Primes and subcontractors that hold FCI on their own systems
- A shop that receives CUI, such as a controlled drawing
- Commercial products and services, when FCI or CUI is involved
- Every tier below the prime that touches FCI or CUI
- Not covered
- Contracts only for commercially available off-the-shelf (COTS) items
- Purchases at or below the micro-purchase threshold
- Federal systems a contractor runs on the Government's behalf
- A procurement DoD waived before the solicitation went out
Which level you need is decided by the information, not by what you sell. FCI is the everyday contract paperwork that is not public; CUI is information a law or regulation says must be protected, most often a drawing or spec with a distribution statement on it. If you are not sure which you hold, FCI vs CUI sorts a shop's paperwork, and what CUI is covers the categories. Down the supply chain, the rule sets the minimum each subcontractor must hold:
| If the subcontract involves | The subcontractor needs |
|---|---|
| FCI only§ 170.23(a)(1) | Level 1 (Self) |
| CUI§ 170.23(a)(2) | Level 2 (Self), at minimum |
| CUI, and the prime's contract requires Level 2 (C3PAO)§ 170.23(a)(3) | Level 2 (C3PAO) |
| CUI, and the prime's contract requires Level 3 (DIBCAC)§ 170.23(a)(4) | Level 2 (C3PAO), at minimum |
Who assesses you
"CMMC certified" only properly describes the statuses an outside assessor gives: Level 2 (C3PAO) and Level 3 (DIBCAC). Level 1 and Level 2 (Self) are self-assessments: you do the work, you score it, and you vouch for it. Four parties can be involved, and only three of them assess.
You
Your own people score each requirement against the assessment objectives in NIST SP 800-171A, then enter the result in SPRS. No outside party signs it off; a senior official affirms it, after the assessment and every year.
A C3PAO
A certified third-party assessment organization, authorized or accredited by the program's one Accreditation Body, the Cyber AB. It enters your result in the CMMC instance of eMASS, which passes it to SPRS, and you get a Certificate of CMMC Status.
DCMA's DIBCAC
The government's own assessors, the Defense Industrial Base Cybersecurity Assessment Center. Under CMMC they run the Level 3 assessments, and only on systems that already hold a Final Level 2 (C3PAO).
A consultant or RPO
A Registered Practitioner Organization advises and helps you prepare; it never certifies. A CMMC ecosystem member that prepared you as a consultant may not take part in your Level 2 certification assessment within 3 years.
What a C3PAO is and how it is chosen is in what a C3PAO is; the advisory side is in what a CMMC RPO is, and firms are compared in CMMC consultants and RPOs. The path from a self-assessment to a certificate, step by step, is in how to get CMMC certified.
$37,196
Level 2 (Self), small entity, per 3-year cycle
$104,670
Level 2 (C3PAO), small entity, per 3-year cycle
These cover the assessment and the affirmations, not fixing anything: DoD "did not consider the cost of implementing the security requirements themselves". Put your own numbers into the CMMC cost estimator.
SPRS: where the score lives
The Supplier Performance Risk System is the DoD database that holds every CMMC result and every affirmation. You reach it through the PIEE portal, and to be considered for award you need a current result posted there. For Level 2 the result is a number, worked out the same way whoever assesses you.
110
The highest Level 2 score: every requirement met
88
The lowest score that still allows a Conditional status and a POA&M
1/3/5
Points each requirement not met takes off; the score can go negative
You start at 110 and subtract the value of each requirement not met. Only two requirements earn partial credit: multi-factor authentication costs 3 points if used only for remote and privileged users, 5 if not used at all; encryption costs 3 points if not FIPS-validated, 5 if absent. Run your own numbers in the SPRS score calculator, and see the screens in how to submit an SPRS score.
The score is older than CMMC. Under DFARS 252.204-7019 and -7020 (NOV 2023), a contractor bound by 800-171 needs a current assessment, not more than 3 years old, with its summary score posted in SPRS, and a Basic Assessment is the contractor's own self-assessment. Under the class deviation, 252.240-7997 (FEB 2026) replaces 7020 in new contracts, and the self-assessment route is CMMC Level 1 or 2 (Self) under 7021; contracts already awarded keep the clause versions they carry. Which text your contract holds is untangled in DFARS 7019 and 7020.
Keep a note of your CMMC UIDs. SPRS gives each assessed system a 10-character identifier, and DFARS 252.204-7021 has you hand those to the contracting officer and report any change during the contract.
POA&Ms: what may wait 180 days
A plan of action and milestones (POA&M) lists what is not done yet and when it will be. Under CMMC it buys you a Conditional status instead of a fail, but only within tight limits. Level 1 allows none at all: no POA&Ms are permitted for CMMC Level 1, so every one of the 15 requirements must be met on the day. At Level 2 all three of these must hold:
- Your score divided by 110 is 0.8 or more: at least 88. § 170.21(a)(2)(i)
- Every item on the POA&M is worth 1 point, except SC.L2-3.13.11 when you encrypt but not with FIPS-validated modules. § 170.21(a)(2)(ii)
- None of the six requirements below is on it, whatever its point value. § 170.21(a)(2)(iii)
Never on a POA&M
- AC.L2-3.1.20
- AC.L2-3.1.22
- CA.L2-3.12.4
- PE.L2-3.10.3
- PE.L2-3.10.4
- PE.L2-3.10.5
Then the clock runs. A POA&M must be closed out within 180 days of the Conditional CMMC Status Date, or the Conditional status expires. Closing it does not reset the date: the Conditional status date stays as your CMMC Status Date, so the three-year cycle counts from the day you first entered the result. The rules are worked through in what a POA&M is, and the POA&M template builder refuses the items the rule refuses.
The timeline, as written and as it stands
Part 170 was written to arrive in four phases, a year apart, so that third-party assessments would reach contracts gradually. The first phase arrived on time; the second has been stopped. Here is every date that matters, with what happened to it.
2017-12-31
NIST SP 800-171 already owedIn force
DFARS 252.204-7012 required NIST SP 800-171 "as soon as practical, but not later than December 31, 2017".
2024-10-15
The CMMC Program rule is publishedDone
The final rule for 32 CFR Part 170 appears in the Federal Register (89 FR 83092).
2024-12-16
Part 170 takes effectDone
32 CFR Part 170 took effect on 2024-12-16.
2025-11-10
Phase 1 beginsDone
Phase 1 began on 2025-11-10, when the DFARS CMMC rule took effect: Level 1 and Level 2 self-assessments in contracts.
2026-07-13
The advance to Phase 2 is suspendedDone
The Department of War CIO suspended the advance to CMMC Phase 2; Class Deviation 2026-O0025 Rev 3 puts that into contracts.
2026-11-10
Phase 2 was dueSuspended
Phase 2 was due on 2026-11-10, one year after Phase 1 began, adding Level 2 (C3PAO) and, at DoD's discretion, Level 3.
2027-11-10
Phase 3, as writtenNot confirmed
As written, Phase 3 begins one calendar year after Phase 2: Level 2 (C3PAO) on all applicable contracts and option periods, and Level 3 (DIBCAC) on all applicable contracts. The date is arithmetic on the rule's text; with Phase 2 suspended, it is not confirmed.
2028-11-10
Phase 4, as writtenNot confirmed
As written, full implementation begins one calendar year after Phase 3, option periods on older contracts included. Arithmetic on the rule's text, not confirmed.
2028-11-10
The clause reaches every FCI or CUI contractAs deviated
Until 2028-11-09 a contract carries the CMMC clause only where the program office requires a specific level; from 2028-11-10 it applies to any contract whose systems process, store or transmit FCI or CUI.
Read the first row twice. Everything CMMC Level 2 checks has been a contract requirement for years, under the clause that is still in force. The dated countdown, with what each date means for a bid, is in the CMMC deadline; the news side of the suspension, kept current, is in CMMC status today.
What to do while Phase 2 is paused
The status box at the top of this page says what binds today. In a small shop it comes down to seven jobs, and none of them depends on when, or whether, third-party assessments return. Each one is a requirement of DFARS 252.204-7012 or the SPRS clauses, which bind wherever a contract carries them, CMMC or not.
| Job, and the rule behind it | Start here |
|---|---|
| Find the CUI and draw the boundary around the systems that hold it32 CFR 170.19 | Scoping worksheet |
| Implement NIST SP 800-171 Rev 2 (not Rev 3) on those systemsDFARS 252.204-7012(b)(2) | 800-171 checklist |
| Keep a current score in SPRS, never more than 3 years oldDFARS 252.204-7019(b) | SPRS score calculator |
| Write the system security plan and keep it currentCA.L2-3.12.4 | SSP template |
| Keep CUI only in a cloud at FedRAMP Moderate or equivalentDFARS 252.204-7012(b)(2)(ii)(D) | GCC High alternatives |
| Be able to report a cyber incident within 72 hours and keep images for 90 daysDFARS 252.204-7012(c), (e) | DFARS 7012 explained |
| Flow the clauses down to every subcontractor that will handle CUIDFARS 252.204-7012(m) | FCI vs CUI |
Two choices make the list far shorter. Shrinking the boundary to a small enclave means fewer systems to bring up to the 110 requirements; the options are compared in CMMC enclaves. And the cloud row is a purchase with a rule attached; how FedRAMP and CMMC fit together is in CMMC vs FedRAMP.
Questions shops ask about CMMC
Is CMMC compliance the same as NIST SP 800-171 compliance?
At Level 2 the requirements are the same: Part 170 says they are identical to NIST SP 800-171 R2. What CMMC adds is the checking around them: who assesses, the result in SPRS, the yearly affirmation and stricter limits on what a POA&M may hold. The differences are laid out in CMMC vs NIST SP 800-171.
Do I need a CMMC certificate today?
Only an assessment by a C3PAO or by DCMA's DIBCAC produces a Certificate of CMMC Status; a self-assessed status lives in SPRS with no certificate. Which statuses contracts can require right now is in the status box at the top of this page, and kept current in CMMC status today.
Which revision of NIST SP 800-171 does CMMC use?
Revision 2. DoD binds NIST SP 800-171 Rev 2: Part 170 incorporates Rev 2, and the deviated 7012 names "Revision 2". NIST published Rev 3 in May 2024 and marks Rev 2 withdrawn on 2024-05-14, but the contract, not NIST's page, decides what you are held to.
Is a small business exempt from CMMC?
No. Part 170 applies to every DoD contractor and subcontractor that handles FCI or CUI on its own systems and names no size threshold. The exceptions are about the purchase: contracts only for COTS items, and purchases at or below the micro-purchase threshold. What a small shop can do to keep the job small is in CMMC requirements for small businesses.
Can compliance software make me CMMC compliant?
No tool assesses for you. Software can track the 110 requirements, hold evidence and draft documents, but the score, the SPRS entry and the affirmation are yours. Six tools are read against the rule in CMMC compliance software compared.
What if something breaks after I affirm?
The affirmation says you have implemented every requirement and will maintain it. DFARS 252.204-7021 counts a status as current only while there are no changes in compliance since its status date, so a requirement that stops being met is not covered by the status you hold. Fix it, record it, and treat the next affirmation as a real check rather than a renewal.